perf: optimize CMS queries, caching, and asset delivery

Database:
- Add missing indexes (users.credits, users_currency(type,amount),
  users_settings.respects_received, camera_web.timestamp,
  messenger_offline.user_id) via migrations 0020/0021
- Use partial .select() everywhere instead of SELECT * (tickets, users,
  rooms, audit logs, catalog tree, polls, radio, password reset)
- Add queryPrepared/queryPreparedOne (server-side prepared statements)
  and switch the login check to a prepared statement; drop dead
  cache options from the pool config
- Raise total_users/total_rooms COUNT(*) cache TTL to 5m

Caching:
- Consolidate the three cache helpers (cached, redisCache, cachedQuery)
  into a single memory-first implementation backed by Redis
- invalidateKey now clears the in-process cache as well as Redis
- Cache homepage sections, news list, and leaderboard tabs; share one
  news_list cache key between homepage and news archive
- siteSettings: in-process cache with TTL so repeated getters no longer
  pay a Redis round-trip per call
- Share a 10s poll cache across all radio SSE connections
- Normalize timestamps after cache reads (Redis JSON round-trip)

Assets:
- Enable AVIF/WebP via images.formats and remove unoptimized from news
  covers and the homepage hero (149KB jpg) with proper sizes/priority
- Support ?format=webp|avif|png in the /imaging proxy via sharp

Other:
- Fix pnpm supply-chain minimumReleaseAge failures by excluding the
  freshly-published packages (next 16.3.1, hookform resolvers 5.8.0,
  resend 6.20.0)
- Remove unused before/after fields from housekeeping AuditEntry

src/lib/services/site-settings.ts

@@ -15,9 +15,20 @@ const DEFAULTS: Record<string, string> = {
 
 const CACHE_TTL_MS = 300_000;
 const REDIS_CACHE_KEY = "site_settings";
+// Short in-process window so repeated getters in one request (header, nav,
+// footer all read hotel_name / logo) don't each pay a Redis round-trip.
+// Redis stays the source of truth across instances.
+const MEMORY_TTL_MS = 60_000;
+
+// During `next build`, pages are prerendered and `Date.now()` is treated as an
+// unstable prerender value — always serve the in-process cache then (settings
+// cannot change mid-build). Runtime keeps the normal TTL check.
+const IS_PRERENDER =
+	process.env.NEXT_PHASE === "phase-production-build" ||
+	process.env.NEXT_PHASE === "phase-production-compile";
 
 class SiteSettings {
-	private cache: Map<string, string> | null = null;
+	private cache: { map: Map<string, string>; expiresAt: number } | null = null;
 
 	private async loadFromDb(): Promise<Map<string, string>> {
 		try {
@@ -32,22 +43,31 @@ class SiteSettings {
 	}
 
 	private async load(): Promise<Map<string, string>> {
+		if (this.cache !== null) {
+			if (IS_PRERENDER || this.cache.expiresAt > Date.now()) {
+				return this.cache.map;
+			}
+		}
+
 		if (redis) {
 			try {
 				const cached = await redis.get(REDIS_CACHE_KEY);
 				if (cached) {
 					const parsed = JSON.parse(cached) as Record<string, string>;
-					return new Map(Object.entries(parsed));
+					const map = new Map(Object.entries(parsed));
+					this.cache = { map, expiresAt: Date.now() + MEMORY_TTL_MS };
+					return map;
 				}
 			} catch {
 				logger.warn("Redis cache read failed for site settings");
 			}
 		}
 
-		if (this.cache !== null) return this.cache;
+		// Expired but usable fallback — keeps the site up if both Redis and DB fail.
+		if (this.cache !== null) return this.cache.map;
 
 		const map = await this.loadFromDb();
-		this.cache = map;
+		this.cache = { map, expiresAt: Date.now() + MEMORY_TTL_MS };
 
 		if (redis) {
 			try {